Fix escaping

Some data was HTML-escaped in the API results. Now data in API results is
(hopefully) all raw and clients have to escape as needed. One client is,
obviously, taginfo itself and a few places have been changed to do the
right escaping now.

Fixes #19.